It'd obviously be a tough rule to craft. In some hypothetical world where I'm the Tzar of writing and enforcing this, I'd tend to allow leeway for companies usi

It'd obviously be a tough rule to craft. In some hypothetical world where I'm the Tzar of writing and enforcing this, I'd tend to allow leeway for companies using data that could be essentially a totally-anonymous incrementing counter (as in this case) to choose how to present their site, based on what's currently being looked at or requested but not on the browsing or purchase history of a particular user. It's using a person's own activity to target, manipulate, or "monetize" them that I find especially objectionable—and the data that's hoarded in the name of those abilities, simply dangerous in ways that the hoarding companies aren't made to account for (a huge negative externality, basically). In general I think if companies want market research they should pay for market research, not just run a dragnet spying operation against their customers. If they want something other than market research out of those data, then they probably ought to just be shut down (or, at least, that part of their business should be) [EDIT] FWIW I don't think these kinds of rules should only apply to tech companies. Physical stores ("loyalty" cards, tracking shoppers' cell phones, that stuff) and banks and similar also shouldn't be able to spy on people, nor to sell or otherwise use data collected as a necessary part of their business against people. A store may reasonably have surveillance cameras, but ought not be able to sell the footage to another company to train & test its gait-recognition software, nor use facial recognition to track how often I visit the store or what I look at. That kind of thing.